CVE-2026-0648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0648", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-01-06T16:19:46.498Z", "datePublished": "2026-01-27T15:40:31.216Z", "dateUpdated": "2026-01-27T15:53:36.128Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Eclipse ThreadX", "repo": "https://github.com/eclipse-threadx/threadx", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "6.4.3", "status": "affected", "version": "6.1.7", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lavine Yue"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The vulnerability stems from an incorrect error-checking logic in the <code>CreateCounter()</code>&nbsp;function (in <code>threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c</code>) when handling the return value of <code>osek_get_counter()</code>. Specifically, the current code checks if <code>cntr_id</code>&nbsp;equals <code>0u</code>&nbsp;to determine failure, but <code>@osek_get_counter()</code>&nbsp;actually returns <code>E_OS_SYS_STACK</code>&nbsp;(defined as <code>12U</code>) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.</p><p>As a result, when the counter pool is depleted, the code proceeds to cast the error code (<code>12U</code>) to a pointer (<code>OSEK_COUNTER *</code>), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., <code>0x0000000C</code>), which can trigger immediate HardFaults or silent memory corruption.</p><p>This vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.</p><br>"}], "value": "The vulnerability stems from an incorrect error-checking logic in the CreateCounter()\u00a0function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id\u00a0equals 0u\u00a0to determine failure, but @osek_get_counter()\u00a0actually returns E_OS_SYS_STACK\u00a0(defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.\n\nAs a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption.\n\nThis vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-253", "description": "CWE-253 Incorrect Check of Function Return Value", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-01-27T15:40:31.216Z"}, "references": [{"url": "https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-xj75-fc68-h4rw"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T15:53:06.324106Z", "id": "CVE-2026-0648", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T15:53:36.128Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T15:53:06.324106Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T15:53:25.302Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lavine Yue"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eclipse-threadx/threadx", "vendor": "Eclipse Foundation", "product": "Eclipse ThreadX", "versions": [{"status": "affected", "version": "6.1.7", "versionType": "semver", "lessThanOrEqual": "6.4.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-xj75-fc68-h4rw"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The vulnerability stems from an incorrect error-checking logic in the CreateCounter()\u00a0function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id\u00a0equals 0u\u00a0to determine failure, but @osek_get_counter()\u00a0actually returns E_OS_SYS_STACK\u00a0(defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.\n\nAs a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption.\n\nThis vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.", "supportingMedia": [{"type": "text/html", "value": "<p>The vulnerability stems from an incorrect error-checking logic in the <code>CreateCounter()</code>&nbsp;function (in <code>threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c</code>) when handling the return value of <code>osek_get_counter()</code>. Specifically, the current code checks if <code>cntr_id</code>&nbsp;equals <code>0u</code>&nbsp;to determine failure, but <code>@osek_get_counter()</code>&nbsp;actually returns <code>E_OS_SYS_STACK</code>&nbsp;(defined as <code>12U</code>) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.</p><p>As a result, when the counter pool is depleted, the code proceeds to cast the error code (<code>12U</code>) to a pointer (<code>OSEK_COUNTER *</code>), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., <code>0x0000000C</code>), which can trigger immediate HardFaults or silent memory corruption.</p><p>This vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-253", "description": "CWE-253 Incorrect Check of Function Return Value"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-01-27T15:40:31.216Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0648", "state": "PUBLISHED", "dateUpdated": "2026-01-27T15:53:36.128Z", "dateReserved": "2026-01-06T16:19:46.498Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-01-27T15:40:31.216Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse ThreadX", "repo": "https://github.com/eclipse-threadx/threadx", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "6.4.3", "status": "affected", "version": "6.1.7", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:threadx:*:*:*:*:*:*:*:*", "matchCriteriaId": "77069C96-3BA5-4AC9-92D4-6753DE8FC8A6", "versionEndExcluding": "6.4.5", "versionStartIncluding": "6.1.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability stems from an incorrect error-checking logic in the CreateCounter()\u00a0function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id\u00a0equals 0u\u00a0to determine failure, but @osek_get_counter()\u00a0actually returns E_OS_SYS_STACK\u00a0(defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.\n\nAs a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption.\n\nThis vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access."}, {"lang": "es", "value": "La vulnerabilidad se deriva de una l\u00f3gica incorrecta de comprobaci\u00f3n de errores en la funci\u00f3n CreateCounter() (en threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) al manejar el valor de retorno de osek_get_counter(). Espec\u00edficamente, el c\u00f3digo actual comprueba si cntr_id es igual a 0u para determinar un fallo, pero @osek_get_counter() en realidad devuelve E_OS_SYS_STACK (definido como 12U) cuando falla. Esta discrepancia hace que la rama de error nunca se ejecute, incluso cuando el pool de contadores est\u00e1 agotado.\n\nComo resultado, cuando el pool de contadores se agota, el c\u00f3digo procede a convertir el c\u00f3digo de error (12U) a un puntero (OSEK_COUNTER *), creando un puntero salvaje. Las escrituras posteriores a miembros de este puntero conducen a escrituras en direcciones de memoria ilegales (por ejemplo, 0x0000000C), lo que puede desencadenar HardFaults inmediatos o corrupci\u00f3n de memoria silenciosa.\n\nEsta vulnerabilidad plantea riesgos significativos, incluyendo posibles ataques de denegaci\u00f3n de servicio (mediante llamadas repetidas para agotar el pool de contadores) y acceso no autorizado a la memoria."}], "id": "CVE-2026-0648", "lastModified": "2026-06-17T10:11:08.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 6.0, "source": "emo@eclipse.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0648", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T15:53:06.324106Z", "version": "2.0.3"}}]}, "published": "2026-01-27T16:16:35.107", "references": [{"source": "emo@eclipse.org", "tags": ["Third Party Advisory"], "url": "https://github.com/eclipse-threadx/threadx/security/advisories/GHSA-xj75-fc68-h4rw"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-253"}], "source": "emo@eclipse.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:48:44.074020+00:00", "value": {"mitigation_remediation": ["Contact Eclipse ThreadX support or check the official Eclipse ThreadX repository for a patched release that corrects the CreateCounter error handling.", "Apply the vendor\u2011issued firmware or source code update that implements proper error checking and prevents the cast of numeric error codes to pointer types.", "Until a patch is available, implement protective measures such as limiting the frequency of counter requests or adding guard checks to detect and prevent counter pool exhaustion, thereby mitigating denial\u2011of\u2011service attacks."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service and memory corruption"}, "threat_synthesis": {"affected_systems": "All implementations of Eclipse ThreadX that include the ThreadX OSEK compatibility layer, as identified by the Eclipse Foundation. The specific code resides in the file threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c. Version details are not enumerated in the advisory, so any build incorporating this source should be considered vulnerable until a patch is applied.", "description_and_impact": "The Core issue stems from an error in the CreateCounter function within the ThreadX OSEK compatibility layer. The function incorrectly checks for a zero counter ID to detect failures, while the underlying osek_get_counter function returns the value 12 (E_OS_SYS_STACK) on exhaustion. Because the error check never triggers, the code proceeds to treat the numeric error code as a pointer. Subsequent writes using this bogus pointer corrupt memory at addresses such as 0x0000000C or trigger immediate hard faults. An attacker can exploit this flaw by repeatedly requesting counters until the pool is depleted, forcing the defective branch and destabilising the system. The result is a functional denial of service or silent memory corruption that could affect integrity and availability of the host application.", "risk_and_exploitability": "The CVSS score of 7.8 marks this vulnerability as high severity. The EPSS score is listed as less than 1%, indicating that, as of the last assessment, exploitation attempts are very rare. The flaw has not been reported in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires triggering counter creation repeatedly\u2014an action that can be performed by local or remote entities that can invoke the affected API. While there is no immediate capability for remote code execution, the ability to crash the system or corrupt memory presents a significant risk to critical embedded systems that rely on ThreadX for real\u2011time performance."}}}}, "created": "2026-01-27T20:16:37.815025+00:00", "title": "ThreadX OSEK Compatibility Layer Counter Pool Exhaustion Causing Memory Corruption", "updated": "2026-04-18T15:00:03.438396+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$threadx"]}